Detection of encrypted packet streams using feedback probing

Abstract

Methods, systems, and devices are disclosed for detecting encrypted Internet Protocol packet streams. A probe stream having a known observable parameter is generated. The observable parameter exhibits a known characteristic of a known type of data encrypted within a stream of packets. The probe stream is communicated to a network element via a communications network. When the probe stream is received by the network element, the network element can compare the known observable parameter to an actual value. Any difference between the known observable parameter and the actual value can be used to correct for network-induced variation and other effects, thus ensuring accurate detection and identification of data types within encrypted streams of packets.

Description

CROSS REFERENCE TO RELATED APPLICATION[0001]This application is a continuation of U.S. patent application Ser. No. 10 / 943,591, filed Sep. 17, 2004, the disclosure of which is hereby incorporated herein by reference. This application relates to the commonly assigned and concurrently filed United States applications: Ser. No. 10 / 944,229, entitled “Detection of Encrypted Packet Streams” (Attorney Docket BS040215); Ser. No. 10 / 943,588, entitled “Signature Specification for Encrypted Packet Streams” (Attorney Docket BS040216); Ser. No. 10 / 944,294, entitled “Detection of Encrypted Packet Streams” (Attorney Docket BS040278); Ser. No. 10 / 943,589, entitled “Detection of Encrypted Packet Streams Using a Timer” (Attorney Docket BS040279); and Ser. No. 10 / 943,590, entitled “Detection of Encrypted Packet Streams Using Process Variation and / or Multiple Processes” (Attorney Docket BS040280). These commonly-assigned applications are all incorporated by reference.NOTICE OF COPYRIGHT PROTECTION[0002]...

AI Technical Summary

Benefits of technology

[0008]The aforementioned problems, and other problems, are reduced, according to exemplary embodiments, using methods, computer systems, computer programs, and computer program products that detect the type of data contained within an encrypted stream of packets. According to the exemplary embodiments, the existence of one or more parameters within the encrypted stream of packets is noted. The one or more parameters are observable, despite encryption obscuring the contents of the encrypted stream of packets. Although the parameters are observable, some parameters may be difficult to detect and to measure. Because networks introduce variations and differences into the parameters, the exemplary embodiments help determine the effects of the network. The exemplary embodiments accurately detect, identify, and reduce these network-induced variations and differences. According to the exemplary embodiments, probing streams are sent to determine and to correct for network-caused changes in the observable parameters. These probing streams exhibit known parameter values through the network. The probing streams are measured in a manner such that the difference between the measurements and the known values can be used to correct for network effects, thus ensuring accurate detection and identification of data types encrypted within a stream of packets.

[0009]The exemplary embodiments generate a probe stream having a known observable parameter. The known observable parameter exhibits a known characteristic naturally or artificially associated with a known type of data encrypted within streams of packets. The probe stream is then communicated to a network element via a communications network. When the probe stream is received by the network element, the network element compares the known observable parameter to an actual value. Any difference between the known observable parameter and the actual value can be used to correct for network-induced variation and other effects, thus ensuring accurate detection and identification of data types within encrypted streams of packets.

Problems solved by technology

Although the parameters are observable, some parameters may be difficult to detect and to measure.

Images